Upload.php:

- should check access
- should check target location is in the files directory
- should use file_munge_filename
- should use a token to prevent CSRF
- should escape nid before display (XSS)

there may be additional problems,

The module:

Should use placeholders in ALL queries.

There may be additional problems.

Comments

greggles’s picture

greggles
he/him
Primary language English
Location Denver, Colorado, USA
CreditAttribution: greggles commented
Issue summary: View changes

Update with actual content

drumm’s picture

drumm
he/him
Location NY, US
CreditAttribution: drumm at Drupal Association commented
Issue summary: View changes
Issue tags: +Security